Double Blinded Privacy-Safe Distributed Data Mining Protocol

1. A method of mining privacy-sensitive data, comprising the steps of: a) formulating a query with at least one condition, b) comparing an initial set of privacy-sensitive data against the at least one condition in the query, and generating a list of specific instances within the initial set of privacy- sensitive data that satisfy the at least one condition, c) transmitting the list via an electronic data communications topology to at least one data source entity having privacy-sensitive transactional data, d) matching, by a data processing machine at the at least one data source entity, specific instances on the list with corresponding items in the privacy-sensitive transactional data, e) de-identifying, by the at least one data source entity, the matched specific instances and corresponding items in the privacy-sensitive transactional data, f) electronically transmitting, by the at least one data source entity, at least one file containing the de-identified, matched specific instances and corresponding items in the privacy-sensitive transactional data, to an aggregator, g) merging, by a data processing machine at the aggregator, the at least one file into a combined result responsive to the query, wherein said merging involves combining together information about multiple different persons or entities, and said merging comprises mixing together information contained in one person's or entity's record with information contained in a different person's or entity's record to produce the combined result responsive to the query.

2. The method of claim 1 , wherein the method also comprises the step of electronically transmitting, by the aggregator, the combined result to at least one data consumer entity having the initial set of privacy-sensitive data.

3. The method of claim 1 , wherein the step of formulating the query is performed by the aggregator, and the step of generating the list is performed by at least one data consumer entity having the initial set of privacy-sensitive data, the data consumer entity receiving the query from the aggregator.

4. The method of claim 3 , wherein the list is transmitted by the at least one data consumer entity directly to the at least one data source entity.

5. The method of claim 3 , wherein the list is transmitted by the at least one data consumer entity to the aggregator, and the aggregator forwards the list to the at least one data source entity.

6. The method of claim 1 , wherein the steps of formulating the query and generating the list are performed by at least one data consumer entity having the initial set of privacy- sensitive data.

7. The method of claim 6 , wherein the list is transmitted by the at least one data consumer entity directly to the at least one data source entity.

8. The method of claim 6 , wherein the list is transmitted by the at least one data consumer entity to the aggregator, and the aggregator forwards the list to the at least one data source entity.

9. The method of claim 1 , wherein the step of formulating the query is performed by the aggregator, and the step of generating the list is performed by at least one data originator entity having the initial set of privacy-sensitive data, the data originator entity receiving the query from the aggregator.

10. The method of claim 9 , wherein the list is transmitted by the at least one data originator entity directly to the at least one data source entity.

11. The method of claim 9 , wherein the list is transmitted by the at least one data originator entity to the aggregator, and the aggregator forwards the list to the at least one data source entity.

12. The method of claim 1 , wherein the steps of formulating the query and generating the list are performed by at least one data originator entity having the initial set of privacy-sensitive data.

13. The method of claim 12 , wherein the list is transmitted by the at least one data originator entity directly to the at least one data source entity.

14. The method of claim 12 , wherein the list is transmitted by the at least one data originator entity to the aggregator, and the aggregator forwards the list to the at least one data source entity.

15. The method of claim 1 , wherein the list is encrypted before being sent to the at least one data source entity.

16. The method of claim 1 , wherein the list includes a sufficiently large number of identity disclosing specifics.

17. The method of claim 1 , wherein the step of merging the at least one file includes filtering out portions of the at least one file which characterize details particular to less than a predetermined number of items in the privacy-sensitive transactional data.

18. The method of claim 1 , wherein formulating a query includes performing a preprocessing privacy check against a predetermined source-entity data-ensemble model.

19. The method of claim 1 , wherein at least one of the steps of comparing and generating, matching, de-identifying, and merging involves fuzzy matching.

20. The method of claim 1 , wherein formulating a query includes transforming the query into a standardized query, capable of resulting in a syndicated reporting of the combined result responsive to the query.